aboutsummaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)AuthorFilesLines
2017-01-03DB connection: prevent src address from binding to a VIPDamien Ciabrini19-0/+83
When a service connects to the database VIP from the node hosting this VIP, the resulting TCP socket has a src address which is by default bound to the VIP as well. If the VIP is failed over to another node while the socket's Send-Q is not empty, TCP keepalive won't engage and the service will become unavailable for a very long time (by default more than 10m). To prevent failover issues, DB connections should have the src address of their TCP socket bound to the IP of the network interface used for MySQL traffic. This is achieved by passing a new option to the database connection URIs. This option is available starting from PyMySQL 0.7.9-2. We use a new intermediate variable in hiera to hold the IP to be used as a source address for all DB connections. All services adapt their database URI accordingly. Moreover, a new YAML validation check is added to guarantee that new services will construct their database URI appropriately. Change-Id: Ic69de63acbfb992314ea30a3a9b17c0b5341c035 Closes-Bug: #1643487
2016-12-23Merge "Split OVN northd and ml2 plugin"Jenkins6-11/+47
2016-12-23Merge "Manage disallow_iframe_embed"Jenkins1-0/+1
2016-12-23Merge "Add network_config_hook interface to run-os-net-config.sh"Jenkins1-0/+6
2016-12-23Merge "Modify external loadbalancer environments to use new FixedIPs"Jenkins2-26/+14
2016-12-23Merge "Add CI matrix to THT"Jenkins1-0/+61
2016-12-22Merge "Introduce role-specific NodeUserData, use for docker"Jenkins8-1/+47
2016-12-22Merge "FreeIPA: Make OTP and FreeIPA server parameters optional"Jenkins1-5/+16
2016-12-22Merge "Use ws instead of http for Zaqar websocket endpoints"Jenkins4-12/+12
2016-12-22Merge "Add bind mounts for agent state"Jenkins1-0/+3
2016-12-22Merge "Adds missing OpenDaylight username/password from ODL OVS service"Jenkins1-0/+11
2016-12-22Merge "Decouple swift-proxy from ceilometer"Jenkins4-21/+46
2016-12-22Add network_config_hook interface to run-os-net-config.shJames Slagle1-0/+6
run-os-net-config.sh only allows for limited customization of the network configuration in config.json. Namely, it only customizes the bridge_name and interface_name. This will likely not be sufficient for all use cases. This patch adds a generic network_config_hook bash function that will be called if it is defined. The function is an entry point for deployers to write custom code to further influence run-os-net-config.sh. A possible alternative approach would be to pass the server resource into the NetworkConfig template. That would allow running arbitrary SoftwareDeployments on the server before NetworkDeployment is executed. However, the interface of NetworkDeployment is likely still not as flexible as this approach as the inputs are hardcoded in the role template files (role.role.j2.yaml), which are not meant to be modified by deployers. The immediate use case for this work is using os-net-config in our multinode CI jobs where we need to create vxlan tunnels between the nodes and we need to know the local private IP of each node for the tunnel endpoint. As the IP is different for each node, it's not a parameter we could specify in the templates. Change-Id: I26d0ebdaba6fcd3fe885e41ed234eb79a2405228 Implements: blueprint multinode-ci-os-net-config
2016-12-22Merge "Add hook to generate metadata from service profiles"Jenkins10-0/+47
2016-12-22Merge "Add a per service bootstrap node variable"Jenkins3-0/+28
2016-12-22Add CI matrix to THTCarlos Camacho1-0/+61
Currently the description of CI matrix is defined in tripleo-ci, but the services for each scenario lives now in THT. This submission moves this table to the repo in which the configuration is defined. Change-Id: I9ef1acefc6e1f347528a48edcb4d997a9628fcf6
2016-12-22Add hook to generate metadata from service profilesJuan Antonio Osorio Robles10-0/+47
This enables the deployer to dynamically add nova metadata to the servers based on the output of service profiles that implement the metadata_settings key in the role_data output for the profiles. One can set an implementation via the OS::TripleO::ServerMetadataHook resource, which currently is set as OS::Heat::None. So, because of the default implementation, if left untouched it actually does nothing. Currently, besides the list, which is metadata_settings, this hook also takes the name of the node that it's setting the metadata for. This is useful for nova vendordata plugins that can parse said metadata. Change-Id: I8a937f711f0b90156fbb6c4632760435ef846474
2016-12-21Merge "Use df instead of findmnt in cephstorage upgrade scripts"Jenkins1-1/+1
2016-12-21Merge "Add "deployed server" fake neutron ports"Jenkins5-29/+78
2016-12-21Merge "Synchronize NetworkDeployment inputs for generic roles"Jenkins1-0/+7
2016-12-21Add a per service bootstrap node variableMichele Baldessari3-0/+28
In order to call commands that need to be run on a single node, we create a new per-service variable that will contain the first node of each role containing the service. Change-Id: I03e8685f939e8ae1fcd8b16883b559615042505d Partial-Bug: #1615983
2016-12-21Merge "Make the openvswitch 2.4->2.5 upgrade more robust"Jenkins10-80/+57
2016-12-21Merge "net-conf: make bridge and interface name optional"Jenkins1-5/+5
2016-12-20Merge "Set the default event pipeline publisher"Jenkins1-0/+5
2016-12-20Merge "Use OS::Heat::DeployedServer"Jenkins4-42/+10
2016-12-20Adds missing OpenDaylight username/password from ODL OVS serviceTim Rozet1-0/+11
ODL username and password are already present in the OpenDaylightApi service. However, when moving the OpenDaylightApi service to its own custom role, the Controller/Compute nodes no longer have access to these hiera values. This patch adds them also to the OpenDaylightOvs service. Closes-Bug: 1651499 Depends-On: I418643810ee6b8a2c17a4754c83453140ebe39c7 Change-Id: I169fdad4c94bd6dfc1fe7cde3d6b19b36d916af7 Signed-off-by: Tim Rozet <trozet@redhat.com>
2016-12-20Set the default event pipeline publisherPradeep Kilambi1-0/+5
Since we have aodh enabled for alarms, we should set the notifier to the default queue alarm.all. Closes-bug: #1590473 Change-Id: Ibcb5076424ac2ddcd18ff717d82da1aec4c035cb
2016-12-20Use ws instead of http for Zaqar websocket endpointsDan Prince4-12/+12
This patch updates the endpoint map for Zaqar websockets so that we use ws (or wss for SSL) instead of the http varients. This should help resolve protocol issues when trying to make connections to the websocket API. Change-Id: Iea88d1e30299cb621424740a39d498defa371ca4
2016-12-20Merge "Expose param to enable legacy ceilometer api"Jenkins1-0/+5
2016-12-20Merge "Move UpgradeInitCommand to role templates"Jenkins7-37/+169
2016-12-20Merge "Run upgrade steps before post-deploy config"Jenkins2-8/+15
2016-12-20FreeIPA: Make OTP and FreeIPA server parameters optionalJuan Antonio Osorio Robles1-5/+16
In the freeipa-enroll.yaml, it can be the case that the node has been enrolled (via a cloud-init script); in this case, the OTP and the FreeIPA server are optional. However, we still need to get a kerberos ticket, which is the last step of this script, since this ticket is what certmonger will use to request the certificates in subsequent steps. Change-Id: I7e9d6a747cdcbe81c9a74a17db5e91aa9d459f65
2016-12-19Merge "Remove unused attr from templates"Jenkins1-1/+0
2016-12-19Merge "Revert "Switch mistral to use authtoken configuration""Jenkins1-4/+2
2016-12-19Revert "Switch mistral to use authtoken configuration"Ben Nemec1-4/+2
It turns out the puppet-mistral change this depends on broke introspection, so we need to back it out for now. This reverts commit ed029e5bf279945e82bff8766af4093856a7ac6a. Change-Id: I828478267935cdc68aa24de8c9dc2d12fcadb631
2016-12-19Merge "Switch mistral to use authtoken configuration"Jenkins1-2/+4
2016-12-19Introduce role-specific NodeUserData, use for dockerSteve Baker8-1/+47
Currently when the docker environments are invoked, every node has the boot script run which replaces os-collect-config with the heat-agents container. This should only be happening on Compute nodes currently, and each role will be converted to heat-agents one at a time. This change implements a role-specific NodeUserData resource and uses that mechanism to run docker/firstboot/install_docker_agents.yaml only on Compute nodes. Change-Id: Id81811dbcaf0e661c3980aa25f3ca80db5ef0954
2016-12-19Add bind mounts for agent stateSteve Baker1-0/+3
These ensure that software configuration tasks are not re-run when the heat-agents container is restarted. Change-Id: Ieb84fe1f6dd849737ff22f51daa12ddc467dcdde
2016-12-19Merge "Add a type for the ControlVirtualIP resource"Jenkins2-1/+2
2016-12-19Merge "Correction to SRIOV THT Examples"Jenkins1-2/+3
2016-12-19Move UpgradeInitCommand to role templatesSteven Hardy7-37/+169
We can't run this during the upgrade steps, because there are things which need to happen before any role configuration happens, e.g installing the new hiera heat-config hook, which must be done before e.g "ControllerDeployment" runs or the stack update hangs. Partially-Implements: blueprint overcloud-upgrades-per-service Change-Id: I365b57513590662c3f78a33dc625747f457c48c5
2016-12-19Run upgrade steps before post-deploy configSteven Hardy2-8/+15
For some upgrade scenarios, e.g all-in-one deployments, it may be possible to run the upgrade steps, then apply puppet in one stack update, so reverse the order here. For normal deployments the upgrade steps are mapped to OS::Heat::None so this will have no effect. Partially-Implements: blueprint overcloud-upgrades-per-service Change-Id: I3c78751349a6ac2bc5dff82f67bffe13750ac21c
2016-12-19Merge "Set rabbitmq's port and IP via the config file and not the env file"Jenkins1-1/+3
2016-12-19Merge "Introduce role-specific nova-server-metadata"Jenkins6-12/+84
2016-12-19Merge "Enable SECURE_PROXY_SSL_HEADER option for horizon"Jenkins1-0/+1
2016-12-19Split OVN northd and ml2 pluginSteven Hardy6-11/+47
This allows us to take advantage of the composable roles hiera settings to connect the plugin to the northd/ovndb API without needing to hard-code the IP of the node running the service. Change-Id: I2508d48f81c1819ae3521fff271c0bdc50724604 Depends-On: I9af7bd837c340c3df016fc7ad4238b2941ba7a95 Closes-Bug: #1634171
2016-12-17Merge "Use hostname -s instead of hostnamectl --transient"Jenkins1-1/+1
2016-12-17Add "deployed server" fake neutron portsDan Prince5-29/+78
This patch swaps out the noop ctlplane port for a more proper fake neutron port stack. This stack is a swap in for the OS::Neutron::Port heat resource and can be controlled via the DeployedServerPortMap parameter. By relying on <hostname>-<network> naming conventions in the map we can map IPs to specific servers without using the Neutron API. This will allow us to inject IP information into the Heat stack within the new t-h-t undercloud installer which currently does not run a Neutron service. Change-Id: I29fbc720c3d582cbb94385e65e4b64b101f7eac9
2016-12-17net-conf: make bridge and interface name optionalDan Prince1-5/+5
Update the run-os-net-config.sh so that we make the bridge_name and interface_name parameters (supplied by the SoftwareConfig) optional. This allows operators to create custom network templates to be used on roles other than compute and controller which appear to be the only two roles which set bridge_name and interface_name parameters. Change-Id: I8997cf8177c1bf0e1f19de5f93dc4e81da1a951f
2016-12-16Introduce role-specific nova-server-metadataJuan Antonio Osorio Robles6-12/+84
We could already pass metadata to the nova server instances (on creation) via the ServerMetadata parameter, however, there was no way of doing this per-role. This introduces that by adding a {{role}}ServerMetadata parameter for each role. This parameter gets merged with the ServerMetadata parameter and allows this functionality. Note that both default to {}, and so does the result of merging those parameters with their default values. So nothing changes for the default settings. Change-Id: I334edcc51ce7ee82fc13b6cf4c0d74ccb7db099c